Medium severity5.3NVD Advisory· Published Mar 6, 2026· Updated Jun 17, 2026
CVE-2018-25186
CVE-2018-25186
Description
Tina4 Stack 1.0.3 contains a cross-site request forgery vulnerability that allows attackers to modify admin user credentials by submitting forged POST requests to the profile endpoint. Attackers can craft HTML forms targeting the /kim/profile endpoint with hidden fields containing malicious user data like passwords and email addresses to update administrator accounts without authentication.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:tina4:tina4_stack:1.0.3:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:tina4:tina4_stack:1.0.3:*:*:*:*:*:*:*
- (no CPE)range: =1.0.3
Patches
Vulnerability mechanics
References
2- www.exploit-db.com/exploits/45834nvdExploitThird Party AdvisoryVDB Entry
- www.vulncheck.com/advisories/tina-stack-cross-site-request-forgery-via-profilenvdBroken Link
News mentions
0No linked articles in our index yet.